1. Introduction
Adjacent to the internal applications running in a public cloud, data center, or on-premises server, Exium places a small piece of software called Cyber Gateway (CGW), deployed as a VM or bare metal, which is used to extend a highly secure Zero Trust Path out to the Intelligent Cybersecurity Mesh.
Its deployment is required for Secure Private Access and SD-WAN services. Please refer SPA Guide for details.
CGWs can co-host DHCP server to assign IP addresses to the devices inside an office or workplace. CGW will act like default gateway to all the devices which will get IP from DHCP server hosted on CGW machine.
Likewise CGWs, DHCP server can also be configured in HA mode to provide uninterrupted services to the devices, seeking IP allocation and management.
2. Deployment Instructions
Pre-requisites
- Minimum 1 CGW or 2 CGWs in HA mode
- For configuration – IP subnet to be managed by DHCP server
- For configuration – Default gateway IP which will be installed and managed by CGW application
- For configuration – DNS servers IP addresses
- For configuration – Domain names of the DHCP servers or the CGW machines
Steps to configure DHCP server
CGW application comes with DHCP server installation, no need to install it manually.
DHCP server configuration with HA
Assuming CGW is already deployed in HA mode and VRRP or floating IP is already configured and available on Active Node.
- Check “sudo xlgateway status” on CGW nodes, to identify state is Active and service is connected.
- Check “ip addr” output to verify VRRP IP is installed on LAN interface
Follow the steps to configure DHCP server in a CGW machines in HA mode:
CGW Primary Node – DHCP Server Primary Node
- Login to CGW Primary node
- Make sure CGW LAN IP is configured statically in netplan configuration.
- Modify netplan configuration and make static entry for CGW LAN interface
- Apply netplan configuration
- Execute below command to download utility to setup DHCP server
| curl -s https://clientreleases.s3.us-west-1.amazonaws.com/cgw/xdhcp_setup.sh | sudo bash |
- Open user input or setup configuration file using an editor. Configure all parameters with valid entries. Refer ‘Appendix‘ section for sample configuration.
| cd /usr/local/bin/
vim config_xdhcp.ini xdhcp-manager -n primary |
CGW Secondary Node – DHCP Server Secondary Node
- Login to CGW Secondary node
- Make sure CGW LAN IP is configured statically in netplan configuration.
- Modify netplan configuration and make static entry for CGW LAN interface
- Apply netplan configuration
- Execute below command to download utility to setup DHCP server
| curl -s https://clientreleases.s3.us-west-1.amazonaws.com/cgw/xdhcp_setup.sh | sudo bash |
- Open user input or setup configuration file using an editor. Configure all parameters with valid entries. Refer ‘Appendix‘ section for sample configuration.
| cd /usr/local/bin/
vim config_xdhcp.ini xdhcp-manager -n secondary |
DHCP server deployment without HA
In case CGW is not deployed in HA (High Availability) mode, DHCP server can still be configured and used for the devices seeking IP allocation.
- Refer section “CGW Primary Node – DHCP Server Primary Node” and install and run single instance
Node Status
Use below command to check the node status (primary/secondary) along with other parameters:
| sudo xdhcp-manager -s show |
Appendix
Sample configuration with example: (Same configuration file or parameters can be used on both primary and secondary nodes to setup DHCP server)
| curl -s https://clientreleases.s3.us-west-1.amazonaws.com/cgw/xdhcp_setup.sh | sudo bash
root@cgw-primary:/usr/local/bin# cat config_xdhcp.ini [HOSTNAME] [DHCP-SERVER-IP] [IP-POOL] [IP-POOL-SUBNET] [IP-POOL-GATEWAY] [IP-POOL-DNS] [LEASE-TIME] [DHCP-INTERFACE] |
VRRP/Floating IP or Gateway IP
192.168.150.1, which is configured above as default gateway, must be configured as VRRP/floating IP in CGW HA setup configuration. In case CGW is already running in HA mode then find out VRRP/floating IP by running command ‘sudo xlgateway status’ and use that IP in DHCP server configuration as default gateway. Do not use or configure default gateway IP at anywhere else.
Node Status Sample
| root@cgw-secondary:/usr/local/bin# xdhcp-manager -s show ##################################### Node type: secondary DHCP Interface: enp0s8 IP Range Start: 192.168.150.1 IP Range End: 192.168.150.254 Default Gateway: 192.168.150.1 Primary DNS IP: 8.8.8.8 Secondary DNS IP: 1.1.1.1 ##################################### |